Learn about security hierarchy

PI Asset Framework (AF) supports both OpenID Connect (OIDC), used for implementing claims-based authentication, and Windows integrated security to authenticate users and establish their PI AF identities through mappings.

If you use OIDC for authentication, you can map Identity provider roles to PI AF identities to assign a group of users to one or more PI AF identities.

PI AF uses the PI AF identities to control read, write, delete, and various other permissions on PI AF components shown in the following illustration. Each securable PI AF object (element, event frame, and notification, and so on) throughout the hierarchy has an associated security descriptor that contains the access permissions information for that object.

All PI AF objects of the same type belong to a collection. For example, every PI AF element in a database belongs to the Elements collection for that database. Each collection also has an associated security descriptor that contains access permission information. Security descriptors for some collections are configured for an entire PI AF server (such as identities and mappings), whereas others (such as analyses, elements, and event frames) can be configured for a specific database.

PI AF hierarchy of securable collections

For more information on collection security, see PI AF collection security.